CVE-2003-1573: sun j2ee SQL Injection

Vulnerability summary

CVE-2003-1573 is a high (CVSS 10.0) SQL Injection vulnerability in sun j2ee. EPSS estimates a 5.04% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 01-06-2009
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.